CVE-2026-66835: Erlang/OTP inets httpd path equivalence authentication bypass

CVE-2026-66835 · Severity: info · CVSS 8.2 · Published 2026-09-01

Erlang/OTP's inets httpd web server has a vulnerability in its mod_auth directory protection that allows unauthenticated remote attackers to read protected files. An attacker can bypass authentication by adding an extra forward slash to the request path, allowing them to access files that should be restricted by directory-level access controls. This directly compromises the confidentiality of protected content and any authentication-gated business logic.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-66835 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-66835 being exploited in the wild.
How severe is CVE-2026-66835?
Informational severity, with a CVSS score of 8.2, published 1 September 2026.
Which products and versions are affected?
Erlang Inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2; Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.
Is there a fix for CVE-2026-66835?
A patch was published on 2026-09-01: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66835 attacked?
It is attacked over the network.
Am I affected by CVE-2026-66835?
Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path equivalence bypass in the httpd request handling chain. The httpd_request:validate_uri/1 function normalizes request URIs using uri_string:normalize/1, which removes RFC 3986 dot-segments but does not collapse consecutive path separators (doubled slashes). The mod_auth:secret_path/3 function uses an unanchored regex to check if a path lies within a protected directory block; the doubled slash breaks the contiguous substring match, causing the path to be treated as unprotected. However, mod_get and the underlying operating system normalize the path correctly and serve the protected file. Additionally, the path mismatch evades per-path security accounting in mod_security. Only servers explicitly configured with mod_auth directory blocks are affected. Patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 (corresponding to inets 9.3.2.7, 9.6.2.3, and 9.7.2).

Affected products

  • Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
  • Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.